linux/fs/nfs
Christian Brauner e65ce2a50c
acl: handle idmapped mounts
The posix acl permission checking helpers determine whether a caller is
privileged over an inode according to the acls associated with the
inode. Add helpers that make it possible to handle acls on idmapped
mounts.

The vfs and the filesystems targeted by this first iteration make use of
posix_acl_fix_xattr_from_user() and posix_acl_fix_xattr_to_user() to
translate basic posix access and default permissions such as the
ACL_USER and ACL_GROUP type according to the initial user namespace (or
the superblock's user namespace) to and from the caller's current user
namespace. Adapt these two helpers to handle idmapped mounts whereby we
either map from or into the mount's user namespace depending on in which
direction we're translating.
Similarly, cap_convert_nscap() is used by the vfs to translate user
namespace and non-user namespace aware filesystem capabilities from the
superblock's user namespace to the caller's user namespace. Enable it to
handle idmapped mounts by accounting for the mount's user namespace.

In addition the fileystems targeted in the first iteration of this patch
series make use of the posix_acl_chmod() and, posix_acl_update_mode()
helpers. Both helpers perform permission checks on the target inode. Let
them handle idmapped mounts. These two helpers are called when posix
acls are set by the respective filesystems to handle this case we extend
the ->set() method to take an additional user namespace argument to pass
the mount's user namespace down.

Link: https://lore.kernel.org/r/20210121131959.646623-9-christian.brauner@ubuntu.com
Cc: Christoph Hellwig <hch@lst.de>
Cc: David Howells <dhowells@redhat.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: linux-fsdevel@vger.kernel.org
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
2021-01-24 14:27:17 +01:00
..
blocklayout SUNRPC: Add xdr_set_scratch_page() and xdr_reset_scratch_buffer() 2020-11-30 14:46:35 -05:00
filelayout SUNRPC: Add xdr_set_scratch_page() and xdr_reset_scratch_buffer() 2020-11-30 14:46:35 -05:00
flexfilelayout NFS client updates for Linux 5.11 2020-12-17 12:15:03 -08:00
Kconfig NFS: Disable READ_PLUS by default 2020-12-10 16:48:03 -05:00
Makefile NFSv4.2: add client side xattr caching. 2020-07-13 17:52:46 -04:00
cache_lib.c NFS client updates for Linux 4.15 2017-11-17 14:18:00 -08:00
cache_lib.h NFS client updates for Linux 4.15 2017-11-17 14:18:00 -08:00
callback.c SUNRPC: Cache the process user cred in the RPC server listener 2019-04-24 09:46:35 -04:00
callback.h NFSv4: Add support for CB_RECALL_ANY for flexfiles layouts 2020-03-16 08:34:30 -04:00
callback_proc.c kernel.h: split out mathematical helpers 2020-12-15 22:46:15 -08:00
callback_xdr.c NFS4: Report callback authentication errors 2020-01-15 10:54:31 -05:00
client.c NFS: NFSv2/NFSv3: Use cred from fs_context during mount 2020-12-02 14:05:54 -05:00
delegation.c NFS: nfs_delegation_find_inode_server must first reference the superblock 2021-01-10 16:29:28 -05:00
delegation.h NFSv4: Ensure the delegation is pinned in nfs_do_return_delegation() 2020-02-13 16:18:50 -05:00
dir.c namei: make permission helpers idmapped mount aware 2021-01-24 14:27:16 +01:00
direct.c NFS client updates for Linux 5.9 2020-08-15 08:26:55 -07:00
dns_resolve.c NFS: remove duplicate headers 2020-05-27 10:10:12 -04:00
dns_resolve.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
export.c nfsd: Record NFSv4 pre/post-op attributes as non-atomic 2020-12-09 09:39:38 -05:00
file.c NFS client updates for Linux 5.9 2020-08-15 08:26:55 -07:00
fs_context.c NFS: Switch mount code to use xprt_find_transport_ident() 2020-12-02 14:05:53 -05:00
fscache-index.c nfs: fscache: use timespec64 in inode auxdata 2020-01-15 10:54:30 -05:00
fscache.c NFSv4: Fix fscache cookie aux_data to ensure change_attr is included 2020-05-08 22:20:24 +01:00
fscache.h nfs: fscache: use timespec64 in inode auxdata 2020-01-15 10:54:30 -05:00
getroot.c NFS: Ensure security label is set for root inode 2020-03-30 19:56:50 -04:00
inode.c NFS: switch nfsiod to be an UNBOUND workqueue. 2020-12-02 14:05:54 -05:00
internal.h NFS: nfs_igrab_and_active must first reference the superblock 2021-01-10 16:29:28 -05:00
io.c NFS: Fix up documentation warnings 2019-02-20 15:14:21 -05:00
iostat.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
mount_clnt.c NFSv3: fix rpc receive buffer size for MOUNT call 2020-05-14 18:42:44 -04:00
namespace.c NFS: fix nfs_path in case of a rename retry 2020-10-06 10:21:18 -04:00
netns.h NFS: Add sysfs support for per-container identifier 2019-07-06 14:54:49 -04:00
nfs.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
nfs2super.c treewide: Add SPDX license identifier for more missed files 2019-05-21 10:50:45 +02:00
nfs2xdr.c SUNRPC: Clean up the handling of page padding in rpc_prepare_reply_pages() 2020-12-02 14:05:53 -05:00
nfs3_fs.h NFS: Additional refactoring for fs_context conversion 2020-01-15 10:15:17 -05:00
nfs3acl.c treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
nfs3client.c NFS: Additional refactoring for fs_context conversion 2020-01-15 10:15:17 -05:00
nfs3proc.c NFS: Allow the NFS generic code to pass in a verifier to readdir 2020-12-02 14:05:52 -05:00
nfs3super.c treewide: Add SPDX license identifier for more missed files 2019-05-21 10:50:45 +02:00
nfs3xdr.c SUNRPC: Clean up the handling of page padding in rpc_prepare_reply_pages() 2020-12-02 14:05:53 -05:00
nfs4_fs.h NFSv4: Wait for stateid updates after CLOSE/OPEN_DOWNGRADE 2020-10-02 08:43:09 -04:00
nfs4client.c NFSv4: Refactor to use user namespaces for nfs4idmap 2020-12-02 14:05:54 -05:00
nfs4file.c NFSv4.2: Fix 5 seconds delay when doing inter server copy 2020-12-10 16:48:03 -05:00
nfs4getroot.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
nfs4idmap.c NFS: Only reference user namespace from nfs4idmap struct instead of cred 2020-10-13 15:56:54 -04:00
nfs4idmap.h
nfs4namespace.c nfs: Fix memory leak of export_path 2020-06-26 08:43:14 -04:00
nfs4proc.c acl: handle idmapped mounts 2021-01-24 14:27:17 +01:00
nfs4renewd.c NFSv4.0: nfs4_do_fsinfo() should not do implicit lease renewals 2020-02-04 12:27:55 -05:00
nfs4session.c treewide: Add SPDX license identifier for missed files 2019-05-21 10:50:45 +02:00
nfs4session.h NFSv4.1: use BITS_PER_LONG macro in nfs4session.h 2020-12-14 06:51:07 -05:00
nfs4state.c treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
nfs4super.c NFS: Adjust fs_context error logging 2021-01-10 13:32:39 -05:00
nfs4sysctl.c nfs: Do not convert nfs_idmap_cache_timeout to jiffies 2018-01-18 15:10:47 -05:00
nfs4trace.c pNFS/flexfiles: Add tracing for layout errors 2020-01-15 10:54:33 -05:00
nfs4trace.h NFSv4/pnfs: Add tracing for the deviceid cache 2020-12-16 17:25:24 -05:00
nfs4xdr.c NFS client updates for Linux 5.11 2020-12-17 12:15:03 -08:00
nfs42.h NFSv4.2: add the extended attribute proc functions. 2020-07-13 17:52:45 -04:00
nfs42proc.c NFSv4.2: fix error return on memory allocation failure 2020-12-16 07:54:42 -05:00
nfs42xattr.c NFSv4.2: fix failure to unregister shrinker 2020-11-12 10:40:02 -05:00
nfs42xdr.c NFS client updates for Linux 5.11 2020-12-17 12:15:03 -08:00
nfsroot.c nfsroot: Default mount option should ask for built-in NFS version 2020-11-02 10:29:03 -05:00
nfstrace.c NFS: Add trace events to report non-zero NFS status codes 2019-02-13 12:03:21 -05:00
nfstrace.h nfs: define and use the NFS_INO_INVALID_XATTR flag 2020-07-13 17:52:45 -04:00
pagelist.c pNFS/flexfiles: Fix array overflow when flexfiles mirroring is enabled 2020-11-30 10:52:22 -05:00
pnfs.c NFS/pNFS: Fix a leak of the layout 'plh_outstanding' counter 2021-01-10 13:32:52 -05:00
pnfs.h pNFS: We want return-on-close to complete when evicting the inode 2021-01-10 13:32:51 -05:00
pnfs_dev.c NFSv4/pnfs: Add tracing for the deviceid cache 2020-12-16 17:25:24 -05:00
pnfs_nfs.c NFS/pNFS: Don't leak DS commits in pnfs_generic_retry_commit() 2021-01-10 13:32:52 -05:00
proc.c NFS: Allow the NFS generic code to pass in a verifier to readdir 2020-12-02 14:05:52 -05:00
read.c NFS: Trace short NFS READs 2020-06-11 13:33:48 -04:00
super.c The one new feature this time, from Anna Schumaker, is READ_PLUS, which 2020-10-22 09:44:27 -07:00
symlink.c nfs: pass the correct prototype to read_cache_page 2019-05-09 16:26:57 -04:00
sysctl.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
sysfs.c NFSv4: Fix up RCU annotations for struct nfs_netns_client 2020-10-15 13:31:08 -04:00
sysfs.h NFSv4: Fix up RCU annotations for struct nfs_netns_client 2020-10-15 13:31:08 -04:00
unlink.c NFS: Avoid referencing the cred twice in async rename/unlink 2020-03-16 08:34:29 -04:00
write.c mm/writeback: discard NR_UNSTABLE_NFS, use NR_WRITEBACK instead 2020-06-02 10:59:08 -07:00